Help Mr. Larry Tate

[privatetimm]

I was following the "Looking for Help - CNET referred/HijackThis" thread because I am having the exact same issue.

Here is what I got when I ran DDS

DDS (Ver_09-06-26.01) - NTFSx86

Internet Explorer: 8.0.6001.19019 BrowserJavaVersion: 1.6.0_21

Microsoft

Attach.txt

[Elise]

Hi, I'm not Larry, but I hope you don't mind me helping you.

Please Download Rootkit Unhooker Save it to your desktop.

• Now double-click on RKUnhookerLE.exe to run it.
  
• Click the Report tab, then click Scan.
  
• Check (Tick) Drivers, Stealth,. Uncheck the rest. then Click OK.
  
• Wait till the scanner has finished and then click File, Save Report.
  
• Save the report somewhere where you can find it. Click Close.
  

Copy the entire contents of the report and paste it in a reply here.

Note - if you get the following warning, just ignore: "Rootkit Unhooker has detected a parasite inside itself!

It is recommended to remove parasite, okay?"

Click on Cancel, then Accept.

[privatetimm]

Here are the results:

RkU Version: 3.8.388.590, Type LE (SR2)

==============================================

OS Name: Windows Vista

Version 6.0.6002 (Service Pack 2)

Number of processors #2

==============================================

>Drivers

==============================================

0x8C602000 C:\Windows\system32\DRIVERS\nvlddmkm.sys 9900032 bytes (NVIDIA Corporation, NVIDIA Windows Kernel Mode Driver, Version 187.66 )

0x82A44000 C:\Windows\system32\ntkrnlpa.exe 3907584 bytes (Microsoft Corporation, NT Kernel & System)

0x82A44000 PnpManager 3907584 bytes

0x82A44000 RAW 3907584 bytes

0x82A44000 WMIxWDM 3907584 bytes

0x8D401000 C:\Windows\system32\DRIVERS\NETw4v32.sys 2256896 bytes (Intel Corporation, Intel

[Elise]

Hi again,

COMBOFIX

---------------

Please download ComboFix from one of these locations:

• 
  

Bleepingcomputer
ForoSpyware

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  
• Double click on Combofix.exe and follow the prompts.
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
  

**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\Combofix.txt in your next reply.

[privatetimm]

Here is the log from ComboFix:

ComboFix 11-04-12.02 - Scott 04/13/2011 10:07:47.1.2 - x86

Microsoft

[Elise]

Hi again, please let me know how things are running after the following fix.

TWO ANTIVIRUS PROGRAMS

---------------------------------------

I do not recommend that you have more than one anti virus product installed and running on your computer at a time. The reason for this is that if both products have their automatic (Real-Time) protection switched on, then those products which do not encrypt the virus strings within them can cause other anti virus products to cause "false alarms". It can also lead to a clash as both products fight for access to files which are opened again this is the resident/automatic protection. In general terms, the two programs may conflict and cause:

• False Alarms: When the anti virus software tells you that your PC has a virus when it actually doesn't.
  
• System Performance Problems: Your system may lock up due to both products attempting to access the same file at the same time.
  

Therefore please go to add/remove in the control panel and remove either MS Security Essentials or McAfee.

CF-SCRIPT

-------------

We need to execute a CF-script.

• Close any open browsers.
  
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  
• Click Start > Run and in the box that opens type notepad and press enter. Copy/paste the text in the codebox below into it:

Firefox::
FF - ProfilePath - c:\users\Scott\AppData\Roaming\Mozilla\Firefox\Profiles\zclo11a3.default\
FF - Ext: XULRunner: {76E3A777-E1B8-491C-B1D1-0C8455F6FD9B} - c:\users\Scott\AppData\Local\{76E3A777-E1B8-491C-B1D1-0C8455F6FD9B}

Save this as CFScript.txt, in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

[privatetimm]

Hi again, please let me know how things are running after the following fix.

TWO ANTIVIRUS PROGRAMS

---------------------------------------

I do not recommend that you have more than one anti virus product installed and running on your computer at a time. The reason for this is that if both products have their automatic (Real-Time) protection switched on, then those products which do not encrypt the virus strings within them can cause other anti virus products to cause "false alarms". It can also lead to a clash as both products fight for access to files which are opened again this is the resident/automatic protection. In general terms, the two programs may conflict and cause:

• False Alarms: When the anti virus software tells you that your PC has a virus when it actually doesn't.
  
• System Performance Problems: Your system may lock up due to both products attempting to access the same file at the same time.
  

Therefore please go to add/remove in the control panel and remove either MS Security Essentials or McAfee.

CF-SCRIPT

-------------

We need to execute a CF-script.

• Close any open browsers.
  
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  
• Click Start > Run and in the box that opens type notepad and press enter. Copy/paste the text in the codebox below into it:

Firefox::
FF - ProfilePath - c:\users\Scott\AppData\Roaming\Mozilla\Firefox\Profiles\zclo11a3.default\
FF - Ext: XULRunner: {76E3A777-E1B8-491C-B1D1-0C8455F6FD9B} - c:\users\Scott\AppData\Local\{76E3A777-E1B8-491C-B1D1-0C8455F6FD9B}

Save this as CFScript.txt, in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

Thanks Elise, I'll run the CFScript.

Any opinion on which AV program I should keep? The reason I installed MS Essentials to begin with is I haven't been impressed with McAfee's ability to keep me from being hit by the fake AV viruses, but I don't know if MS Essentials is going to be any better.

[privatetimm]

Here is the next ComboFix result:

ComboFix 11-04-13.03 - Scott 04/13/2011 20:20:46.2.2 - x86

Microsoft

[Elise]

Hi, how are things running now?

I agree with you on keeping MS Security Essentials. To remove McAfee completely, run the removal tool.

Dowload and save McAfee Removal Tool to your desktop.

Run it to remove McAfee. After this, please restart your computer.

[privatetimm]

Thanks Elise for all the help so far. I am on the road and left the laptop home, but I will use it this weekend and see how it goes.

Thanks for all the help so far.

T

[Elise]

No problem, thank you for letting me know.

[privatetimm]

Hey Elise, everything looks good, I've been back on my computer for three days and I haven't been redirected one, so thank you so much.

T

[Elise]

Hi again, I'm glad to hear that! Lets do some last steps to make sure everything stays okay.

Important Note: Your version of Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system.

• Microsoft: